Skip to main content
Topics#VisualforcePregunta de Alex Packard
Alex Packard (Salesvue) preguntó en #Visualforce
21 ene 2021, 19:52

Spring 21 CSP Problem

Spring 21 CSP Problem

In Spring 21 it appears that attempting to load an iframe of a page from a managed package, it gets blocked by Content Security Policy.

Say you have a package whose namespace is "MyNS", which includes a visualforce page named "Inner_Page". Now include that page via iframe in another visualforce page, like so:

 

<apex:page >
    Iframe Test
    <iframe src="MyNS__Inner_Page"/>
</apex:page>

You will see the "Iframe Test" text loads successfully, but the iframe does not and there will be the following error will appear in the browser console:

https://my-org-domain--myns.cs41.visual.force.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".

This is going to break multiple pages in our application when it is released to production.

Has anyone else seen this?  Will it be fixed before Spring 21 is officially released?

 
2 respuestas
  1. Alex Packard (Salesvue)
    21 ene 2021, 21:39
    Hi Vinay.  Thanks for finding that, it does seem related.  I think my issue is new, however, because the error doesn't occur in Winter 21, only in Spring 21
Escribir una respuesta...
0/9000